I want to download files from my office computer to my laptop.

I can connect my office machine by SSH to the organization server and then SSH from the server to my office machine.

The only commands the organization server accepts are ssh, ssh1, and ssh2.

How can I download a file from my office (remote) machine through the server into my laptop (local) machine?


8 Answers 8


If you have a recent OpenSSH (8.0) locally, you can use the -J (jump) switch:

scp -J user@intermediate user@target:/path

With older versions (but at least 7.3), you can use ProxyJump directive, either on command-line:

scp -o ProxyJump=user@intermediate user@target:/path

or in ssh_config file, as the answer by @Ángel shows.

There are other options like ProxyCommand or port forwarding, which you can use on even older versions of OpenSSH. These are covered in Does OpenSSH support multihop login?

  • 2
    This should be the accepted answer. I despise all the answers to ssh questions which suggest modifying your config for specific hosts when a simple command line option is enough to do the job.
    – clemisch
    Commented Aug 26, 2019 at 16:05
  • 3
    "Despise" seems like an extreme reaction. Sure, there are cases where a quick modification of the command line is easier than having to first modify the configuration file. But if you are planning to connecting to the same host multiple times, I would surely rather update my configuration file once than use -J user@intermediate every time I need to connect.
    – chepner
    Commented Aug 26, 2019 at 17:29

The previous answers mention how to use the ProxyJump directive (added in OpenSSH 7.3) to connect through an intermediate server (usually referred to as the bastion host), but mention it just as a command line argument.

Unless it is a machine you won't be connecting in the future, the best thing is that you configure it on ~/.ssh/config.

I would put a file like:

Host office-machine
Hostname yochay-machine.internal.company.local
ProxyJump bastion-machine

Host bastion-machine
Hostname organization-server.company.com

If you are using an earlier version of OpenSSH which doesn't support ProxyJump, you would replace it with the equivalent:

ProxyCommand ssh -W %h:%p bastion-machine

and if your local ssh version was a really ancient one that didn't support -W:

ssh bastion-machine nc %h %p

although this last one requires that the bastion machine has nc installed.

The beauty of ssh is that you can configure each destination on the file, and they will stack very nicely. Thus you end up working with office-machine as the hostname on all the tools (ssh, scp, sftp...) as they were direct connects, and they will figure out how to connect based in the ssh_config. You could also have wildcards like Host *.internal.company.local to make all hosts ending like that going through a specific bastion, and it will apply to all of them. Once configured correctly, the only difference between doing one hop connections or twenty would be the slower connection times.


Sometimes we can just use the pipeline. That time is today.

ssh -A user@host1 ssh user@host2 cat filename > filename

You can upload too

ssh -A user@host1 ssh user@host2 cat \\\> filename < filename

Yeah there are other solutions involving proxying, etc. but knowing how to do this is useful.

  • Useful use of cat! Commented Aug 27, 2019 at 13:19
  • 1
    Note this gives any sufficiently privileged user of the intermediate host access to your ssh agent and keys. The data flowing between your host and host2 will also exist unencrypted on host1. The methods using proxies, and jump above avoid both of these problems.
    – james
    Commented Aug 27, 2019 at 16:21
  • @james: I am not unaware. Bastion hosts like these are usually very trustworthy.
    – Joshua
    Commented Aug 28, 2019 at 0:54

Use the ProxyJump configuration:

Specifies one or more jump proxies as either [user@]host[:port] or an ssh URI. Multiple proxies may be separated by comma characters and will be visited sequentially. Setting this option will cause ssh(1) to connect to the target host by first making a ssh(1) connection to the specified ProxyJump host and then establishing a TCP forwarding to the ultimate target from there.

scp -o ProxyJump=user@intermediate user@target:/path

There is an ancient protocol called ZMODEM: few programs support it these days, but when it works, it can be pretty convenient.

First check if your laptop's terminal program supports ZMODEM. (For example, you can configure iTerm2 (on Mac) to support ZMODEM. An example script is available here.)

In your office machine, run: sudo apt install lrzsz

Now all you have to do is ssh to your office machine, and run sz (filename). The file will be downloaded via your terminal.


Configuration under ssh of user: ~/.ssh/config

Host *
    ServerAliveInterval 300
    ServerAliveCountMax 2
    ForwardAgent yes

Host jump server
    HostName server.company.org
    User root

Host jump1 server1
    HostName server1.dmz.company.org
    User root
    ProxyJump jump

Host jump2 server2
    HostName server.dmz2.company.org
    User root
    ProxyJump jump1

Host *.intranet.company.org
    User user
    ProxyJump jump2

You can copy now from intranet server directly over 3 jump server.

scp [email protected]:/home/user/ ./*

I preffer this because of no longer need to specify jump servers with scp


Via SCP -3:

scp -3 user1@remote1:/root/file1.txt user2@remote2:/root/file1.txt
  • 2
    The -3 option is described as "Copies between two remote hosts are transferred through the local host." while I believe this question stipulates that the local host could not access "remote2".
    – Jeff Schaller
    Commented Aug 27, 2019 at 16:05
  • 2
    @JeffSchaller : you connect to the machine in the middle, then use -3. But this assumes that you can connect from the middle machine back to the first one.
    – Joe
    Commented Aug 27, 2019 at 21:41
  • I do not see any advantage of this over -J/JumpHost. Quite on the contrary as it has the limitation that @Joe mentions. Commented Aug 28, 2019 at 6:26

This is what worked for me:

scp -o 'ProxyJump user@intermediate' user@target:/fiepath .

The . at the end indicate target download path is the current folder

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .